6 ms·

Anyone go out of their way to disable IPV6 on all their systems, even at the hardware level, like on routers etc? What's a good reason to avoid IPV6?

by vmoore 4y ago

dekhn 4y ago
Yes I turn it off because it's always causing unpredictable problems. I actually tried to switch to all IPv6 and that was worse than ipv4 because you still need to run a full ipv4 stock to visit almost anything on the web without a proxy
leohonexus 4y ago
I recently disabled IPv6 on my home network to make firewall rules more manageable, and I was always under the impression IPv6 adoption was slow. So I was pretty surprised to check and see Google user's adoption has reached 40%. I feel like ISPs are a big push for that.
- patmorgan23 4y ago
  It's probably mostly from mobile carriers. Thought I know Comcast runs v6 on large portions of their residential networks.
cassianoleal 4y ago
If you have a large estate of IPv4 addresses, the more ubiquitous IPv6 gets, the less they're worth.
- zeristor 4y ago
  Not there yet it seems: https://ipv4marketgroup.com/ipv4-pricing/ https://ipv4marketgroup.com/ipv4-pricing/
  - cassianoleal 4y ago
    We're still at a point where at least 60$ of users (according to Google) are still IPv4-only. I imagine we're still a little far from the tipping point where IPv4 becomes less valuable.
xur17 4y ago
I recently disabled it on my router because dns would fail to work after a day or 2. When I did more research, it looked like others were running into the same issue, but there was no known fix, so the easiest solution was to disable ipv6 entirely. I used to go out of my way to get ipv6 working (back when it was "new" I used a bridge service to get access), but I simply do not have the time to figure out what might be wrong with it anymore.
- aidenn0 4y ago
  I run ipv6 but still use v4 for DNS
resoluteteeth 4y ago
In the past there have been cases where firewall defaults were configured incorrectly for IPV6 and stuff would get inadvertently exposed. I don't think that's as common now but I could see just entirely disabling ipv6 to avoid this if you don't want to specifically test to make sure the configuration is correct.
ajsnigrutin 4y ago
Firewalls are more complex on IPv6 (you need to pass a bunch of ICMPv6 through, to make it work), and some residential routers have very bad or even zero firewall support for ipv6, so your devices, that would otherwise be "protected" (not really) by NAT are now directly visible to everyone on the internet. This usually isn't a problem for power users (who know how to set up and (re)confgure a firewall) nor for most basic users (windows firewall does that for them), but people "in the middle", who install some service and just fully disable the OS's firewall to be able to connect to it, are now vulnerable.
- neilalexander 4y ago
  > Firewalls are more complex on IPv6 This is not true. Firewall rules work exactly the same in IPv6 land as they do in IPv4 land. > you need to pass a bunch of ICMPv6 through, to make it work Indeed you shouldn't block ICMPv6, but that is not really making anything "more complex". > some residential routers have very bad or even zero firewall support for ipv6 Is there a proven set of routers that go through the trouble of supporting IPv6 routing but not include a firewall?
  - ajsnigrutin 4y ago
    > Firewall rules work exactly the same in IPv6 land as they do in IPv4 land. Yes, rules do work exactly the same, but with IPv4, you just let all the connections out through, and let just the established and connected ones back. > Indeed you shouldn't block ICMPv6, but that is not really making anything "more complex". But it is... you need a bunch of new rules to pass through, limit or block a bunch of ICMPv6 messages.. there's a whole RFC just for that - https://datatracker.ietf.org/doc/html/rfc4890 https://datatracker.ietf.org/doc/html/rfc4890 > Is there a proven set of routers that go through the trouble of supporting IPv6 routing but not include a firewall? Yeah, a bunch of ISP CPEs have just a single checkmark "IPv6 firewall" on/off, and some older ones not even that (i'm talking about old sagem and innbox equipment i came in contact with, not sure about other telcos and the shity cpes they give out to the customers).
    - 4y ago
HWR_14 4y ago
I do. I don't know why, but when debugging some network issues I discovered just shutting IPv6 down fixed the issue. Could it have been a buggy implementation on a single device on the network messing everything up? Maybe. But since I have no real benefit for IPv6, it was trivial to turn off. It also lets me wait until other people (hopefully) build better privacy systems.
- jeroenhd 4y ago
  IPv6 has had privacy built in for years now, on every OS available. Your inbound address will remain static and possible MAC address derived, but unless you're hosting anything on it (or disabled your firewall) your network traffic will be perfectly private. I've noticed several websites where IPv6 has lower latency than IPv4. The ease of accessing different VMs on cloud providers that will hand out a single IPv4 address, though alternatives like Betternet/Tailscale/Tor will also work around that problem.
  - oldjavacoder 4y ago
    "IPv6 has had privacy built in for years now, on every OS available. Your inbound address will remain static and possible MAC address derived, but unless you're hosting anything on it (or disabled your firewall) your network traffic will be perfectly private." I've tested with IPv6 on and off on several machines over the course of months. Google's search results become wild and unpredictable on the same machines soon after switching to IPv4. My theory is that they rely on that IPv6 address to know exactly who they are providing results to and thus selling to. If that theory didn't hold water, there would be exactly zero difference in search results after switching to all IPv4.
    - jeroenhd 4y ago
      I've switched between IPv4 and IPv6 and Google's search results are practically equally bad after switching between either. Unless you're behind CGNAT, I suppose. I've noticed that many IPv6 address blocks have more up to date location information from parties like Maxmind.
brobinson 4y ago
>What's a good reason to avoid IPV6? IPv6-only CVEs (these have existed!)
- patmorgan23 4y ago
  Cause there are no IPv4 only CVEs
  - naniwaduni 4y ago
    You can have both if you want!
jeroenhd 4y ago
Ubiquity has several gateway products that have no hardware acceleration for IPv6. It's not a _good_ reason, Ubiquity should've included IPv6 support from the start with the price they're asking, but it's a reason.
- jasondclinton 4y ago
  Even worse, to this day, Ubiquity still does not support Android IPv6 clients because their internal-facing RA dnsmasq configuration has a bug. It would take an engineer a few hours to fix it; it's a one-line change. It's been reported and tracked internally in their support queue for more than two years; nothing has come of it.
  - jeroenhd 4y ago
    It's stuff like this that's turned me away from buying Ubiquity.
tyingq 4y ago
Yes, there are situations like "The crap VPN (hello AnyConnect) my work makes me use doesn't work if IPV6 is enabled. And I could troubleshoot it, but it's easier to disable IPV6 on my PC".
- phpisthebest 4y ago
  Default config, last I checked, for AnyConnect is to block all ipv6 even if split tunneling it enabled, the client will block all ipv6 unless it has been specifically configured to allow
  - tyingq 4y ago
    There's all sorts of things controlled at the head end. As mentioned, didn't troubleshoot it. But, disabling ipv6 on my PC, and then everything works. Turn it back on, nothing works.
nightpool 4y ago
Not a residential user, but I ran a small p2p gateway for a few hundred users, and I ended up having to disable ipv6 resolution for remote servers because so many servers would just advertise an AAAA address that didn't work, so we got tons of timeouts. I would say this affected maybe 10% of servers. A lot of them seemed to be hosted on Hetzner, but I never got a good sense of the root cause—mostly seemed to be lack of testing or usage, like users who had typoed an ipv6 address or moved their servers and updated their A record without remembering to update their AAAA.
oldjavacoder 4y ago
Yes. Actually no, not disable, I use Local-Local, there's a rare application here and there that needs to see an IPv6 stack is available then connects normally over IPv4. Google and anyone touting IPv6 can take IPv6 and have a nice day.
mypalmike 4y ago
I've disabled it on my router. My reasoning is that I don't know what kind of firewall rules, if any, the router has for ipv6 traffic. If it's just going to forward any valid incoming ipv6 dst address, that would seem like a new risk. I'm happy to be convinced otherwise by knowledgeable folks.
collsni 4y ago
Yes at my router for privacy. Not nat means no source device obfuscation. No source device obfuscation equals device tracking
- icehawk 4y ago
  RFC3041 (Privacy Extensions for Stateless Address Autoconfiguration in IPv6) and it's successors have been around for 20 years now and are supported in every major operating system. In fact, macOS is so aggressive about using temporary addresses that I had to turn off SLAAC in order to be able to ssh back into my desktop.
dijit 4y ago
I did it before because I assumed it was causing issues and not configuring things on my network properly. I was wrong and the issues were elsewhere, but it remained disabled on the router for a long time. I’m generally a person who resists change and I can’t tangibly see the benefits of ipv6; until I realised that “port-forwarding” is an exclusively NAT problem and it’s much easier with ipv6 to just natively open a port on the firewall if I want.
collsni 4y ago
Yes at my router for privacy. No nat means no source device obfuscation
ajross 4y ago
Stuff breaks. I fought this fight a few years back just to educate myself, and the mere presence of IPv6 on the network, DHCPv6 addresses being handed out, AAAA records being returned from the local caching DNS, etc... made all sorts of software loopy. One I remember in particular was that if you hit a default openssh configuration from the local (!) network, even on a link-local address, it would try to do a RDNS lookup and take 6 seconds or somesuch to time out. I remember a coworker telling me about a TV that would request and accept a DHCPv6 address and then fail hard getting to the internet. Wifi router firmware likewise messes things up, etc... It frankly just wasn't worth the hassle. Mobile networks that can control and enforce the full stack have been able to make it work. My guess is home/wifi environments will be IPv4/NAT until the end of time, frankly.
- ta2478367 4y ago
  Because its an over-engineered pile of shit. The only thing required was an increase in the address space, but we got IPv6 instead, which everyone sane resists to this day. Defaulting to hex addressing only a sheltered engineer would do.
  - Dagger2 4y ago
    It's not very over-engineered; most parts of it work the same as v4 does, just with bigger addresses. Writing the addresses in hex is because doing so is easier. It lines up with the binary better which makes subnetting easier, and do you really want to deal with addresses that look like "32.1.13.184.133.163.0.0.0.0.138.46.3.112.115.52"?
jedberg 4y ago
Yep, I do. About once a year I try IPv6, and give up after a couple weeks when I keep having weird transient errors that I can't pin down accessing websites and other remote hosts, all of which go away the moment I turn off IPv6. Maybe it's me, maybe I have a bad config or bad hardware, but it just doesn't work for me.
- js2 4y ago
  I have AT&T fiber. I've been running IPv6 for about 2 years now and haven't had any issues at all. iCloud Private Relay also works via IPv4/IPv6, but I have had to disable it once or twice. Who is your ISP? How do sites like https://ipv6-test.com/ https://ipv6-test.com/ and https://test-ipv6.com/ https://test-ipv6.com/ score your connection when you have IPv6 enabled?
  - jedberg 4y ago
    AT&T fiber. Haven't tried those particular sites, but the ones I did try to test it all passed (but weren't as thorough as the ones you linked). Next time I try I'll use those sites and see what they say.
icelancer 4y ago
Yeah, we've disabled it at our SMB at the router-level. No real benefit from using it and it causes DNS issues. We were actually advised to do this by our commercial ISP.

Anyone go out of their way to disable IPV6 on all their systems, even at the hardware level, like on routers etc? What's a good reason to avoid IPV6?

by vmoore 4y ago

Anyone go out of their way to disable IPV6 on all their systems, even at the hardware level, like on routers etc? What's a good reason to avoid IPV6?

dekhn 4y ago

Yes I turn it off because it's always causing unpredictable problems. I actually tried to switch to all IPv6 and that was worse than ipv4 because you still need to run a full ipv4 stock to visit almost anything on the web without a proxy

leohonexus 4y ago

I recently disabled IPv6 on my home network to make firewall rules more manageable, and I was always under the impression IPv6 adoption was slow. So I was pretty surprised to check and see Google user's adoption has reached 40%. I feel like ISPs are a big push for that.

patmorgan23 4y ago
It's probably mostly from mobile carriers. Thought I know Comcast runs v6 on large portions of their residential networks.

cassianoleal 4y ago

If you have a large estate of IPv4 addresses, the more ubiquitous IPv6 gets, the less they're worth.

zeristor 4y ago
Not there yet it seems: https://ipv4marketgroup.com/ipv4-pricing/ https://ipv4marketgroup.com/ipv4-pricing/
- cassianoleal 4y ago
  We're still at a point where at least 60$ of users (according to Google) are still IPv4-only. I imagine we're still a little far from the tipping point where IPv4 becomes less valuable.

xur17 4y ago

I recently disabled it on my router because dns would fail to work after a day or 2. When I did more research, it looked like others were running into the same issue, but there was no known fix, so the easiest solution was to disable ipv6 entirely. I used to go out of my way to get ipv6 working (back when it was "new" I used a bridge service to get access), but I simply do not have the time to figure out what might be wrong with it anymore.

aidenn0 4y ago
I run ipv6 but still use v4 for DNS

resoluteteeth 4y ago

In the past there have been cases where firewall defaults were configured incorrectly for IPV6 and stuff would get inadvertently exposed. I don't think that's as common now but I could see just entirely disabling ipv6 to avoid this if you don't want to specifically test to make sure the configuration is correct.

ajsnigrutin 4y ago

Firewalls are more complex on IPv6 (you need to pass a bunch of ICMPv6 through, to make it work), and some residential routers have very bad or even zero firewall support for ipv6, so your devices, that would otherwise be "protected" (not really) by NAT are now directly visible to everyone on the internet. This usually isn't a problem for power users (who know how to set up and (re)confgure a firewall) nor for most basic users (windows firewall does that for them), but people "in the middle", who install some service and just fully disable the OS's firewall to be able to connect to it, are now vulnerable.

neilalexander 4y ago
> Firewalls are more complex on IPv6 This is not true. Firewall rules work exactly the same in IPv6 land as they do in IPv4 land. > you need to pass a bunch of ICMPv6 through, to make it work Indeed you shouldn't block ICMPv6, but that is not really making anything "more complex". > some residential routers have very bad or even zero firewall support for ipv6 Is there a proven set of routers that go through the trouble of supporting IPv6 routing but not include a firewall?
- ajsnigrutin 4y ago
  > Firewall rules work exactly the same in IPv6 land as they do in IPv4 land. Yes, rules do work exactly the same, but with IPv4, you just let all the connections out through, and let just the established and connected ones back. > Indeed you shouldn't block ICMPv6, but that is not really making anything "more complex". But it is... you need a bunch of new rules to pass through, limit or block a bunch of ICMPv6 messages.. there's a whole RFC just for that - https://datatracker.ietf.org/doc/html/rfc4890 https://datatracker.ietf.org/doc/html/rfc4890 > Is there a proven set of routers that go through the trouble of supporting IPv6 routing but not include a firewall? Yeah, a bunch of ISP CPEs have just a single checkmark "IPv6 firewall" on/off, and some older ones not even that (i'm talking about old sagem and innbox equipment i came in contact with, not sure about other telcos and the shity cpes they give out to the customers).
  - 4y ago

HWR_14 4y ago

I do. I don't know why, but when debugging some network issues I discovered just shutting IPv6 down fixed the issue. Could it have been a buggy implementation on a single device on the network messing everything up? Maybe. But since I have no real benefit for IPv6, it was trivial to turn off. It also lets me wait until other people (hopefully) build better privacy systems.

jeroenhd 4y ago
IPv6 has had privacy built in for years now, on every OS available. Your inbound address will remain static and possible MAC address derived, but unless you're hosting anything on it (or disabled your firewall) your network traffic will be perfectly private. I've noticed several websites where IPv6 has lower latency than IPv4. The ease of accessing different VMs on cloud providers that will hand out a single IPv4 address, though alternatives like Betternet/Tailscale/Tor will also work around that problem.
- oldjavacoder 4y ago
  "IPv6 has had privacy built in for years now, on every OS available. Your inbound address will remain static and possible MAC address derived, but unless you're hosting anything on it (or disabled your firewall) your network traffic will be perfectly private." I've tested with IPv6 on and off on several machines over the course of months. Google's search results become wild and unpredictable on the same machines soon after switching to IPv4. My theory is that they rely on that IPv6 address to know exactly who they are providing results to and thus selling to. If that theory didn't hold water, there would be exactly zero difference in search results after switching to all IPv4.
  - jeroenhd 4y ago
    I've switched between IPv4 and IPv6 and Google's search results are practically equally bad after switching between either. Unless you're behind CGNAT, I suppose. I've noticed that many IPv6 address blocks have more up to date location information from parties like Maxmind.

brobinson 4y ago

>What's a good reason to avoid IPV6? IPv6-only CVEs (these have existed!)

patmorgan23 4y ago
Cause there are no IPv4 only CVEs
- naniwaduni 4y ago
  You can have both if you want!

jeroenhd 4y ago

Ubiquity has several gateway products that have no hardware acceleration for IPv6. It's not a _good_ reason, Ubiquity should've included IPv6 support from the start with the price they're asking, but it's a reason.

jasondclinton 4y ago
Even worse, to this day, Ubiquity still does not support Android IPv6 clients because their internal-facing RA dnsmasq configuration has a bug. It would take an engineer a few hours to fix it; it's a one-line change. It's been reported and tracked internally in their support queue for more than two years; nothing has come of it.
- jeroenhd 4y ago
  It's stuff like this that's turned me away from buying Ubiquity.

tyingq 4y ago

Yes, there are situations like "The crap VPN (hello AnyConnect) my work makes me use doesn't work if IPV6 is enabled. And I could troubleshoot it, but it's easier to disable IPV6 on my PC".

phpisthebest 4y ago
Default config, last I checked, for AnyConnect is to block all ipv6 even if split tunneling it enabled, the client will block all ipv6 unless it has been specifically configured to allow
- tyingq 4y ago
  There's all sorts of things controlled at the head end. As mentioned, didn't troubleshoot it. But, disabling ipv6 on my PC, and then everything works. Turn it back on, nothing works.

nightpool 4y ago

Not a residential user, but I ran a small p2p gateway for a few hundred users, and I ended up having to disable ipv6 resolution for remote servers because so many servers would just advertise an AAAA address that didn't work, so we got tons of timeouts. I would say this affected maybe 10% of servers. A lot of them seemed to be hosted on Hetzner, but I never got a good sense of the root cause—mostly seemed to be lack of testing or usage, like users who had typoed an ipv6 address or moved their servers and updated their A record without remembering to update their AAAA.

oldjavacoder 4y ago

Yes. Actually no, not disable, I use Local-Local, there's a rare application here and there that needs to see an IPv6 stack is available then connects normally over IPv4. Google and anyone touting IPv6 can take IPv6 and have a nice day.

mypalmike 4y ago

I've disabled it on my router. My reasoning is that I don't know what kind of firewall rules, if any, the router has for ipv6 traffic. If it's just going to forward any valid incoming ipv6 dst address, that would seem like a new risk. I'm happy to be convinced otherwise by knowledgeable folks.

collsni 4y ago

Yes at my router for privacy. Not nat means no source device obfuscation. No source device obfuscation equals device tracking

icehawk 4y ago
RFC3041 (Privacy Extensions for Stateless Address Autoconfiguration in IPv6) and it's successors have been around for 20 years now and are supported in every major operating system. In fact, macOS is so aggressive about using temporary addresses that I had to turn off SLAAC in order to be able to ssh back into my desktop.

dijit 4y ago

I did it before because I assumed it was causing issues and not configuring things on my network properly. I was wrong and the issues were elsewhere, but it remained disabled on the router for a long time. I’m generally a person who resists change and I can’t tangibly see the benefits of ipv6; until I realised that “port-forwarding” is an exclusively NAT problem and it’s much easier with ipv6 to just natively open a port on the firewall if I want.

collsni 4y ago

Yes at my router for privacy. No nat means no source device obfuscation

ajross 4y ago

Stuff breaks. I fought this fight a few years back just to educate myself, and the mere presence of IPv6 on the network, DHCPv6 addresses being handed out, AAAA records being returned from the local caching DNS, etc... made all sorts of software loopy. One I remember in particular was that if you hit a default openssh configuration from the local (!) network, even on a link-local address, it would try to do a RDNS lookup and take 6 seconds or somesuch to time out. I remember a coworker telling me about a TV that would request and accept a DHCPv6 address and then fail hard getting to the internet. Wifi router firmware likewise messes things up, etc... It frankly just wasn't worth the hassle. Mobile networks that can control and enforce the full stack have been able to make it work. My guess is home/wifi environments will be IPv4/NAT until the end of time, frankly.

ta2478367 4y ago
Because its an over-engineered pile of shit. The only thing required was an increase in the address space, but we got IPv6 instead, which everyone sane resists to this day. Defaulting to hex addressing only a sheltered engineer would do.
- Dagger2 4y ago
  It's not very over-engineered; most parts of it work the same as v4 does, just with bigger addresses. Writing the addresses in hex is because doing so is easier. It lines up with the binary better which makes subnetting easier, and do you really want to deal with addresses that look like "32.1.13.184.133.163.0.0.0.0.138.46.3.112.115.52"?

jedberg 4y ago

Yep, I do. About once a year I try IPv6, and give up after a couple weeks when I keep having weird transient errors that I can't pin down accessing websites and other remote hosts, all of which go away the moment I turn off IPv6. Maybe it's me, maybe I have a bad config or bad hardware, but it just doesn't work for me.

js2 4y ago
I have AT&T fiber. I've been running IPv6 for about 2 years now and haven't had any issues at all. iCloud Private Relay also works via IPv4/IPv6, but I have had to disable it once or twice. Who is your ISP? How do sites like https://ipv6-test.com/ https://ipv6-test.com/ and https://test-ipv6.com/ https://test-ipv6.com/ score your connection when you have IPv6 enabled?
- jedberg 4y ago
  AT&T fiber. Haven't tried those particular sites, but the ones I did try to test it all passed (but weren't as thorough as the ones you linked). Next time I try I'll use those sites and see what they say.

icelancer 4y ago

Yeah, we've disabled it at our SMB at the router-level. No real benefit from using it and it causes DNS issues. We were actually advised to do this by our commercial ISP.